Penetration testing in the US typically runs from around $1,140 for a very small environment to $128,000 for an unlimited one, with hourly rates between $134 and $285. Those figures come from awarded US state government contracts rather than vendor marketing, and they are ceilings on a public contract rather than commercial averages.
The useful part is not the headline range. It is that on a single contract where every vendor priced against the same published definition of scope, quotes for identical environments came in 17 times apart. This guide shows the real cost ranges, the arithmetic behind a quote, and what the spread actually tells you about the penetration testing cost you are being offered. Penetration testing typically costs what the scope justifies, and the sections below show how penetration test pricing is assembled rather than guessed.
What penetration testing costs in the US
Most published penetration testing pricing traces back to a testing firm's own marketing page. We went somewhere harder to argue with instead.
US state governments competitively bid penetration testing services and publish the awarded prices as public records. The Mississippi Department of Information Technology Services security assessment contract is one of them. Fourteen vendors won places on it. Every one of them priced against the same published definition of an environment, measured in devices and IP addresses, which makes their numbers directly comparable in a way that vendor blog ranges never are. We checked the contract again in August 2026: the state last republished the awarded vendor pool on 16 June 2026, every vendor below is still on it, and the December 2024 price lists remain the pricing in force.
Two things to hold in mind before you read this pricing table. These are not-to-exceed ceiling prices on a government contract, so they bound what a buyer could be charged rather than describe an average invoice. And they are not our prices. Onyx publishes no price list, for reasons the next section makes concrete.
| Scope tier (as defined in the contract) | Lowest awarded | Median awarded | Highest awarded |
|---|---|---|---|
| Under 25 devices, under 75 IP addresses | $1,140 | $6,380 | $19,200 |
| 25 to 100 devices, 75 to 300 IP addresses | $1,530 | $11,057 | $25,600 |
| 100 to 500 devices, 300 to 1,500 IP addresses | $2,500 | $15,440 | $38,400 |
| 500 to 2,000 devices, 1,500 to 6,000 IP addresses | $4,995 | $28,580 | $76,800 |
| Unlimited devices and IP addresses | $7,500 | $47,160 | $128,000 |
Black box penetration testing, awarded not-to-exceed prices across eight vendors, price lists dated December 2024 and still in force as of the vendor pool republished 16 June 2026. The unlimited tier reflects six vendors, as two priced that tier hourly rather than as a fixed ceiling. Source: Mississippi Department of Information Technology Services, RFP 4350.
Device count and IP count are the two numbers worth knowing about yourself before any conversation with a testing provider. They drive the cost of penetration testing more than any other input, which is why every serious pen testing pricing conversation starts there. They are the closest thing the market has to a common unit, and they are the first thing a competent scoping call will ask you for.
Why identical scopes get quoted 17x apart
Here is the finding that should change how you read any quote.
At the smallest tier on that contract, where the scope is contractually fixed at under 25 devices and under 75 IP addresses, awarded prices ran from $1,140 to $19,200. That is roughly 17 times apart for the same defined environment. At the large tier, the spread was $4,995 to $76,800, roughly 15 times. Same contract, same scope definition, same competitive process.
Scope alone does not explain that. Three things do:
- Manual depth against automated coverage: a scanner run and a write-up costs a fraction of manual penetration testing, where a tester chains vulnerabilities and probes business logic by hand. Business logic testing in particular cannot be automated.
- Tester seniority: an experienced tester who has found and disclosed real vulnerabilities costs more per hour and finds more vulnerabilities per hour.
- What sits inside the number: reporting, quality assurance, and a retest are billable work. A quote that excludes them looks cheaper and is not.
This is also why the accreditation bodies decline to define a standard test. When CREST developed its Defensible Penetration Test specification in June 2023, it considered prescribing a fixed scope requiring full coverage against all possible attack vectors. After what the document describes as hundreds of hours of industry deliberation, it concluded that the range of use cases made a single defined scope unworkable, and specified how a test should be scoped, delivered and signed off instead.
The body that certifies penetration testing providers looked at whether a standard test could be defined and decided it could not. A range is the honest form of the answer. A single pentest price would be a guess wearing a suit. Cost depends on what is in scope, and no pricing model survives contact with an environment it has not seen.
Not sure how big your scope actually is?
The free self-assessment maps what you are running before anyone puts a number on it.
Hourly rates and how a quote is actually built
Every credible penetration testing quote is built the same way: an estimate of tester days multiplied by a day rate. Scoping fixes the day count, which is where nearly all of the cost is decided.
Published hourly rates on the same state contract, across seven vendors:
| Rate type | Lowest | Median | Highest |
|---|---|---|---|
| Remote testing | $134 | $185 | $210 |
| On-site testing | $149 | $210 | $285 |
Most engagements are quoted on fixed-price terms rather than hourly pricing, so these rates usually surface as change order rates when scope is added mid-engagement. Multiply them by the testing days in your scope and you have the arithmetic behind any average cost figure you have been quoted. That calculation tells you what your own engagement might cost far more reliably than an average penetration testing price pulled from a blog. They are still the clearest window into what an hour of testing is worth.
Note what the day count has to cover. NIST SP 800-115, the federal technical guide to security testing, describes penetration testing in four phases: planning, discovery, attack, and reporting. Only one of those is the part people picture. Planning and reporting are billable work in every credible engagement, and a quote that appears to skip them has usually just moved them somewhere you cannot see.
It is worth separating a tester's salary from a tester's billing rate, because the two get conflated constantly. US Bureau of Labor Statistics data puts the median wage for information security analysts at $124,910 a year as of May 2024, with a mean hourly wage of $67.07 as of May 2025. The gap between that and a $185 billing rate is not margin alone. It covers scoping time, report writing, peer review, tooling and licenses, insurance, and the hours a tester is not on a billable engagement.
Cost by what you are testing
Network testing is priced by the size of the environment. Web application penetration testing is usually priced per application, and several other test types are separate line items rather than parts of one number. An internal penetration test and an external penetration test are costed separately even when they run back to back, so internal testing and external testing appear as two line items rather than one.
| What is tested | Awarded range | What moves the number |
|---|---|---|
| Web application, per application | $800 to $11,100 (median $5,000) | Authenticated user roles and endpoint count |
| Manual source code review, per application | $800 to $15,000 (median $5,000) | Codebase size and language. A separate engagement from application testing |
| Social engineering, smallest to largest scope | $1,000 to $96,000 | Priced against the same device and IP tiers. Median $2,980 at the smallest, $10,700 at the large tier |
| Network, internal and external penetration test | See the scope tier table above | Device count and IP count, not the number of individual targets |
Authenticated roles are the detail most buyers underestimate on web application testing. Testing an application with one user type is a fraction of the effort of testing one with an admin, a manager, a standard user, and an API consumer, because each role has to be tested against every function it can reach and against every function it should not be able to reach.
On mobile application penetration testing, cloud penetration testing, and container testing: you will find confident per-platform figures for these circulating online. We are not going to repeat them, because every one we could trace led back to a testing vendor's own marketing page rather than to an auditable source, and the contract data above has no line item for them. They are real cost drivers, they expose vulnerability classes a network test will not reach, and they should be priced separately in any quote you receive. We would rather tell you a number does not exist than invent one that sounds authoritative.
What actually drives the price
Six cost factors move a penetration testing pricing quote more than anything else. Each one impacts the cost differently, and together they explain the spread in the tables above.
1. Scope and the number of targets
The single biggest driver. Testing one external-facing web application is a fraction of the work of testing five applications, an internal network, a cloud environment, and an API. Price scales with the size of the attack surface a testing team has to cover by hand, which is why the contract above prices in devices and IP addresses rather than in engagements.
2. The type of test
An external network test, an internal network test, a web or mobile application test, an API test, a cloud configuration review, and a social engineering engagement are all different types of penetration test with different effort and pricing. Each type of penetration test carries its own effort profile, and each one you add to the scope will add to the cost. The overall cost is built from the different types of penetration tests you require, and each is additive. The line items in the table above are priced separately for exactly this reason.
3. Depth and methodology
The depth of testing you buy is a pricing decision. A surface-level test costs less than a deep, manual engagement that chains vulnerabilities and performs business logic testing. A credible provider follows a published testing methodology such as OWASP, PTES, or NIST SP 800-115, and that rigor is part of what you are buying. Security testing to a recognized standard takes more time and produces findings your auditor will accept.
4. The approach: black, grey, or white box
Black box (no prior knowledge) takes longer because the penetration tester has to discover the environment first. White box testing (full access to code and architecture) is faster and often deeper for the same money. Grey box sits between. The right testing approach depends on the assurance you need, and it moves the day count directly. Black box testing costs more for the same coverage because reconnaissance is billable time.
5. Whether a retest is included
A good engagement includes a retest after you fix the findings, to confirm the issues are closed and to produce an updated report. Some firms include it, others charge separately. Always check, because a report without a retest leaves you unable to prove remediation.
6. The seniority of the testers
A test run by an experienced penetration tester who has found and disclosed real vulnerabilities costs more than one run by junior staff following a checklist. When an audit or an enterprise customer depends on the result, the higher cost of a senior tester is usually the better investment.
How compliance changes the math
Compliance rarely creates a separate price. It fixes the frequency and the minimum scope, which turns a one-off cost into a recurring one.
PCI Security Standards Council guidance requires penetration testing at least annually and after any significant change, such as an infrastructure or application upgrade, a modification, or a new system component installation. The testing covers both the external perimeter and the internal perimeter of the cardholder data environment, and any vulnerability found in either has to be remediated and verified. PCI DSS v4.0.1 is the active version, as v4.0 was retired on 31 December 2024. Where segmentation controls isolate the cardholder data environment, segmentation testing may be an additional line item.
SOC 2 and HIPAA work differently and are often described inaccurately. A SOC 2 engagement produces an attestation report issued by a licensed CPA firm, not a certificate, and there is no HIPAA certification of any kind. Penetration testing supports both, and enterprise customers frequently ask for it during procurement, but neither framework prescribes it in the specific terms PCI DSS does. Budget for what your auditor and your customers will actually ask to see.
Why the cheapest quote is rarely the cheapest
Do the arithmetic before you accept a low number.
The lowest awarded price at the smallest scope tier on that state contract was $1,140. At the median awarded remote rate of $185 an hour, that buys just over six hours of tester time. Even at the lowest awarded rate of $134, it buys under nine hours. That is enough for an automated scan and a short write-up. It is not enough for a person to map an environment, confirm each vulnerability by hand, chain findings into an attack path, write a report an auditor will accept, and retest.
This is not an argument that cheap penetration tests are always wrong. It is an argument for converting every penetration test quote into hours before you compare them, because hours are the only unit that shows what you are actually buying. A low quote usually means one of three things: a smaller scope than you need, an automated scan presented as a test, or junior testers. Any of those can cost far more later through a failed audit, a missed vulnerability, or a report an enterprise customer rejects.
Compare pricing on scope and deliverables, not the headline figure. How much does penetration testing cost is the wrong first question. What is in scope is the right one.
What a fair quote includes
| Line item | What good looks like | Red flag |
|---|---|---|
| Scope definition | Agreed targets, in and out of scope, rules of engagement in writing | Quote issued before a scoping call |
| Executive summary | Non-technical stakeholder can read and act on it | No exec summary in the sample report |
| Technical findings | CVSS-aligned ratings, reproduction evidence, attack-path context | Scanner-style output with no proof |
| Remediation guidance | Developer-ready, specific fixes in priority order | Generic "apply patches" advice |
| Retest | Included within an agreed window, updated report issued | Retest charged separately or absent |
| Compliance mapping | Evidence framed to your framework (PCI DSS / SOC 2 / HIPAA) | One-size report regardless of your framework |
If you are still shortlisting providers, how to choose a penetration testing company covers the evaluation criteria in full.
How to control the cost without cutting corners
You can manage the price honestly. Scope tightly to what matters most this quarter rather than testing everything at once. Provide good access so testers spend time finding issues, not mapping your environment. Bundle related targets into one engagement. Fix findings before the retest so you are not paying for repeated cycles.
None of these reduce the quality of the test. They reduce wasted hours. Cutting the day count by cutting depth is a different decision entirely, and it changes what the report is worth when someone asks you to prove it.
How Onyx helps
The cost ranges above are the market, not our rate card. We publish no price list, because a number that has not been scoped to your environment is a guess, and the 17x spread in that contract data is what guessing looks like at scale.
We scope every engagement before we quote it. You get a defined plan stating exactly what is tested, the methodology we follow (OWASP, PTES, NIST SP 800-115), and what you receive: an executive summary, CVSS-aligned findings with proof, prioritized developer-ready remediation, and a retest within an agreed window. Our testers hold eCPPT, CRTP, and CEH, with CREST-accredited testing available through our CREST-member partner.
If you are still deciding whether you need a pen test at all, penetration testing vs vulnerability scanning draws the line between a vulnerability scan and a manual penetration test, and our penetration testing service sets out how we run an engagement.
Want a real number for your environment?
Tell us what needs testing and what is driving it. We will scope it and quote against a defined plan on a 30-minute call. No obligation.
Sources
- Mississippi Department of Information Technology Services - "RFP 4350 Security Assessment Services, awarded vendor price lists, December 2024" - https://www.its.ms.gov/services/security-assessment-services
- CREST - "CREST Defensible Penetration Test (CDPT), June 2023" - https://www.crest-approved.org/wp-content/uploads/2022/12/CREST-Defensible-Penetration-Test-v5-2.pdf
- National Institute of Standards and Technology - "SP 800-115, Technical Guide to Information Security Testing and Assessment" - https://csrc.nist.gov/pubs/sp/800/115/final
- US Bureau of Labor Statistics - "Occupational Outlook Handbook, Information Security Analysts" - https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm
- PCI Security Standards Council - "Penetration Testing Guidance" - https://www.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf
FAQ
How much does a penetration test cost?
On one competitively bid US state contract, awarded ceiling prices for a black box penetration test ran from $1,140 to $19,200 for an environment under 25 devices and 75 IP addresses, and from $4,995 to $76,800 for 500 to 2,000 devices. Median awarded prices were $6,380 and $28,580 respectively. Those are government contract ceilings rather than commercial averages, and the spread at every tier is wide because scope, depth, and tester seniority vary far more than the headline number suggests.
What is the hourly rate for penetration testing?
Across seven vendors awarded places on the same US state security assessment contract, published hourly rates ran from $134 to $210 for remote work (median $185) and from $149 to $285 for on-site work (median $210). Most engagements are quoted as a fixed price built from an estimated number of tester days rather than billed hourly, so the hourly rate usually surfaces only for change orders and additional scope.
How much does a web application penetration test cost?
Per-application prices on the same contract ran from $800 to $11,100, with a median of $5,000. The number of authenticated user roles and the count of endpoints move this figure more than anything else, because each role has to be tested against every function it can reach. A manual source code review is a separate line item, awarded between $800 and $15,000 per application.
Why do penetration test quotes vary so much?
Because the word "scope" hides enormous variation. On one state contract where every vendor priced against the same published definition of an environment, awarded prices for the smallest tier still ranged from $1,140 to $19,200, roughly 17 times apart. The difference is manual depth against automated coverage, the seniority of the testers, and whether reporting and a retest sit inside the number or outside it.
Is a cheaper penetration test a good deal?
Check the arithmetic before deciding. At the median awarded remote rate of $185 an hour, the lowest awarded price at the smallest scope tier buys roughly six hours of tester time, which covers a scan and a short write-up rather than manual testing. A low price usually signals a narrower scope than you need, an automated scan presented as a test, or junior testers. Any of the three can cost more later through a failed audit or a missed vulnerability.
How much does a PCI DSS penetration test cost?
There is no separate PCI price. PCI DSS requires penetration testing at least annually and after any significant change, covering both the external perimeter and the internal perimeter of the cardholder data environment, so the cost is driven by how large that environment is and how often you have to repeat the test. PCI DSS v4.0.1 is the active version, as v4.0 was retired on 31 December 2024. If segmentation controls are in place, segmentation testing may be an additional line item.
Does the price include a report and a retest?
A good quote includes a full report with an executive summary, CVSS-aligned findings, proof, and prioritized fixes, plus a retest within an agreed window to confirm remediation. Some providers charge for the retest separately, so confirm it before you sign. CREST guidance treats formal sign-off against the agreed scope as a distinct phase of a defensible test, not an optional extra.
How can I reduce the cost of a penetration test?
Scope tightly to what matters most, provide good access with a white-box or grey box approach so testers spend time finding issues rather than mapping your environment, bundle related targets, and fix findings before the retest. These reduce wasted hours without reducing the quality of manual testing. Cutting the day count by cutting depth is a different decision, and it changes what the report is worth.